CalvinBackup/SpotiFLAC-Mobile
1
0
Fork 0
mirror of https://github.com/zarzet/SpotiFLAC-Mobile.git synced 2026-08-02 17:18:36 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(session): block challenged session generations

Browse Source
This commit is contained in:
zarzet
2026-07-30 13:09:42 +07:00
parent 177a176218
commit 113ad7ed9b
3 changed files with 158 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/EXTENSION_DEVELOPMENT.md
+6 -1
View File
@@ -115,7 +115,12 @@ gateway session state for the exact `SESSION_INVALID/bootstrap_session` or
applies bounded `Retry-After` handling to retryable `PROVIDER_UNAVAILABLE`
responses. `403 REQUEST_AUTH_INVALID` preserves the session and only retries
once when a newer session generation is already available. BYOA
reauthentication remains a separate provider action.
reauthentication remains a separate provider action. An active generation that
receives canonical `428 VERIFY_REQUIRED` is blocked in the shared coordinator,
so later requests join the same verification flow instead of hitting the
gateway repeatedly. Every retry is a newly signed request with a fresh
timestamp and nonce; `retryable: true` therefore also asserts that any ticket
attached to the operation is safe/idempotent for that retry.
Do not use legacy spellings such as `display_name`, `types`,
`permissions.network.domains`, or an object for `permissions.network`.